[jira] [Commented] (WICKET-4427) possible to bypass PackageResourceGuard

["Martin Grigorov (Commented) (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WICKET-4427?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13215479#comment-13215479 ] 

Martin Grigorov commented on WICKET-4427:
-----------------------------------------

I cannot reproduce this problem.
Please either attach a quickstart or a patch for org.apache.wicket.markup.html.SecurePackageResourceGuardTest that shows the problem. Thanks!
                
> possible to bypass PackageResourceGuard
> ---------------------------------------
>
>                 Key: WICKET-4427
>                 URL: https://issues.apache.org/jira/browse/WICKET-4427
>             Project: Wicket
>          Issue Type: Bug
>          Components: wicket
>    Affects Versions: 1.4.18
>            Reporter: Sebastiaan van Erk
>
> It is possible to bypass the filters in the PackageResourceGuard by adding %10, %13, or %20 to the end of the url, i.e., http://my.site.com/myapp/mounted_package/myfile.properties%20

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira